CVE-2015-8421

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField thickness setter. When the thickness parameter is an object with a valueOf method that removes the TextField's parent movie clip, the freed memory is subsequently accessed [2]. This affects Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and corresponding SDK versions [1]. The vulnerability is one of many patched in the December 2015 security update.

Exploitation

An attacker can exploit this by delivering a crafted SWF file to a victim. The proof-of-concept demonstrates that setting tf.thickness to an object with a valueOf function that calls mc.removeMovieClip() triggers the use-after-free [2]. No authentication or user interaction beyond opening the SWF is required; the attacker only needs to convince the user to view the malicious content in a browser or application that uses Flash.

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player. This can lead to full system compromise, including data theft, installation of malware, or denial of service [1]. The vulnerability is rated critical with a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C).

Mitigation

Adobe released fixed versions on December 8, 2015: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.559 (Linux), and AIR 20.0.0.204 [1]. Gentoo recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available; users must apply the update. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.